bugtraq - Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091030173833.GB7008@elf.ucw.cz>
Date: Fri, 30 Oct 2009 18:38:33 +0100
From: Pavel Machek <pavel@....cz>
To: Marco Verschuur <marco@....nl>
Cc: Jim Paris <jim@...n.com>, Dan Yefimov <dan@...htwave.net.ru>,
	bugtraq@...urityfocus.com
Subject: Re: /proc filesystem allows bypassing directory permissions on
 Linux

Hi!

> Your assumption that the same file descriptor is being re-opened is
> wrong!
> The file descriptor retrieved via /proc is a new one. It is not the
> same as the
> initial read-only.

True, we were just being sloppy with the words. But it does not matter
one iota.

> As Martin Rex already explained yesterday, /proc is all virtual.
> The item referred as fd in /proc is not a real file descriptor and as
> of that, that 'not-tfor-real file descriptor' is also not re-opend
> and so does
> not become read-write.

True.

> Imagen:
> - a house surrounded with a fence with all doors unlocked (file with
> perm 0666)
> - a drive-way leads to the gate in the fence and the gate is
> unlocked (dir with perms 777)
> - next we put a lock on the gate and don't give guest the key (dir
> with perms 700)
> - guest cannot access the house because he can't pass the gate
> - now we take an airplane and parachute guest straight into the
> perimeter of the fence (/proc access)
> - guest can access the house (write the file), because the house has
> all doors unlocked

Exactly, and I'm saying that airplanes should not exist (fix the 
/proc).  Martin Rex had another solution -- allow fcntl() to remove
read-only and append-only limitations, so that behaviour is at least
explicit.

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html